Implement multiple executors

.github/workflows/codeql.yml

@@ -57,6 +57,12 @@ jobs:
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
 
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: |
+          8
+          9
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)

Microsoft.GA4GH.TES.sln

@@ -49,6 +49,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Tes.SDK", "src\Tes.SDK\Tes.
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Tes.SDK.Tests", "src\Tes.SDK.Tests\Tes.SDK.Tests.csproj", "{AE7ADB92-BEC6-4030-B62F-BDBB6AC53CB4}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Tes.Repository", "src\Tes.Repository\Tes.Repository.csproj", "{515A4905-0522-4C72-BC18-41BE6A3BE880}"
+EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Tes.SDK.Examples", "src\Tes.SDK.Examples\Tes.SDK.Examples.csproj", "{08A30572-2C5A-4F61-AF77-36F624A6020B}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "build-push-acr", "src\build-push-acr\build-push-acr.csproj", "{9DD148A9-86DA-4BB4-886C-1D29E11A0BB3}"
@@ -119,6 +121,10 @@ Global
 		{AE7ADB92-BEC6-4030-B62F-BDBB6AC53CB4}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{AE7ADB92-BEC6-4030-B62F-BDBB6AC53CB4}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{AE7ADB92-BEC6-4030-B62F-BDBB6AC53CB4}.Release|Any CPU.Build.0 = Release|Any CPU
+		{515A4905-0522-4C72-BC18-41BE6A3BE880}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{515A4905-0522-4C72-BC18-41BE6A3BE880}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{515A4905-0522-4C72-BC18-41BE6A3BE880}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{515A4905-0522-4C72-BC18-41BE6A3BE880}.Release|Any CPU.Build.0 = Release|Any CPU
 		{08A30572-2C5A-4F61-AF77-36F624A6020B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{08A30572-2C5A-4F61-AF77-36F624A6020B}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{08A30572-2C5A-4F61-AF77-36F624A6020B}.Release|Any CPU.ActiveCfg = Release|Any CPU

src/CommonUtilities.Tests/ArmEnvironmentEndpointsTests.cs

@@ -147,22 +147,17 @@ private static bool Equals(IReadOnlyDictionary<string, object?> x, T y)
         [DataRow("AzureChinaCloud", "https://management.chinacloudapi.cn/.default", DisplayName = "AzureChinaCloud")]
         public async Task FromKnownCloudNameAsync_ExpectedDefaultTokenScope(string cloud, string audience)
         {
-            var environment = await AzureCloudConfig.FromKnownCloudNameAsync(cloudName: cloud, retryPolicyOptions: Microsoft.Extensions.Options.Options.Create(new Options.RetryPolicyOptions()));
+            var environment = await SkipWhenTimeout(AzureCloudConfig.FromKnownCloudNameAsync(cloudName: cloud, retryPolicyOptions: Microsoft.Extensions.Options.Options.Create(new Options.RetryPolicyOptions())));
             Assert.AreEqual(audience, GetPropertyFromEnvironment<string>(environment, nameof(AzureCloudConfig.DefaultTokenScope)));
         }
 
-        private static T? GetPropertyFromEnvironment<T>(AzureCloudConfig environment, string property)
-        {
-            return (T?)environment.GetType().GetProperty(property)?.GetValue(environment);
-        }
-
         [DataTestMethod]
         [DataRow(Cloud.Public, "AzureCloud", DisplayName = "All generally available global Azure regions")]
         [DataRow(Cloud.USGovernment, "AzureUSGovernment", DisplayName = "Azure Government")]
         [DataRow(Cloud.China, "AzureChinaCloud", DisplayName = "Microsoft Azure operated by 21Vianet")]
         public async Task FromKnownCloudNameAsync_ExpectedValues(Cloud cloud, string cloudName)
         {
-            var environment = await AzureCloudConfig.FromKnownCloudNameAsync(cloudName: cloudName, retryPolicyOptions: Microsoft.Extensions.Options.Options.Create(new Options.RetryPolicyOptions()));
+            var environment = await SkipWhenTimeout(AzureCloudConfig.FromKnownCloudNameAsync(cloudName: cloudName, retryPolicyOptions: Microsoft.Extensions.Options.Options.Create(new Options.RetryPolicyOptions())));
             foreach (var (property, value) in CloudEndpoints[cloud])
             {
                 switch (value)
@@ -189,5 +184,23 @@ public async Task FromKnownCloudNameAsync_ExpectedValues(Cloud cloud, string clo
                 }
             }
         }
+
+        private static T? GetPropertyFromEnvironment<T>(AzureCloudConfig environment, string property)
+        {
+            return (T?)environment.GetType().GetProperty(property)?.GetValue(environment);
+        }
+
+        private static async Task<T> SkipWhenTimeout<T>(Task<T> task)
+        {
+            try
+            {
+                return await task;
+            }
+            catch (TaskCanceledException e) when (e.InnerException is TimeoutException)
+            {
+                Assert.Inconclusive(e.Message);
+                throw new System.Diagnostics.UnreachableException();
+            }
+        }
     }
 }

src/CommonUtilities/AzureServicesConnectionStringCredential.cs

@@ -71,7 +71,7 @@ private AzureServicesConnectionStringCredentialOptions()
 
         private void SetInitialState(AzureCloudConfig armEndpoints)
         {
-            (GetEnvironmentVariable("AZURE_ADDITIONALLY_ALLOWED_TENANTS") ?? string.Empty).Split((char[]?)[';'], StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ForEach(AdditionallyAllowedTenants.Add);
+            (GetEnvironmentVariable("AZURE_ADDITIONALLY_ALLOWED_TENANTS") ?? string.Empty).Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ForEach(AdditionallyAllowedTenants.Add);
             TenantId = GetEnvironmentVariable("AZURE_TENANT_ID")!;
             AuthorityHost = armEndpoints.AuthorityHost ?? new(armEndpoints.Authentication?.LoginEndpointUrl ?? throw new ArgumentException("AuthorityHost is missing", nameof(armEndpoints)));
             Audience = armEndpoints.ArmEnvironment?.Audience ?? armEndpoints.Authentication?.Audiences?.LastOrDefault() ?? throw new ArgumentException("Audience is missing", nameof(armEndpoints));
@@ -113,6 +113,11 @@ private void SetInitialState(AzureCloudConfig armEndpoints)
         /// </summary>
         public bool DisableInstanceDiscovery { get; set; }
 
+        /// <summary>
+        /// Options controlling the storage of the token cache.
+        /// </summary>
+        public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get; set; }
+
         /// <summary>
         /// Specifies tenants in addition to the specified <see cref="TenantId"/> for which the credential may acquire tokens.
         /// Add the wildcard value "*" to allow the credential to acquire tokens for any tenant the logged in account can access.
@@ -134,23 +139,17 @@ private void SetInitialState(AzureCloudConfig armEndpoints)
 
         internal Azure.Identity.AzureCliCredential CreateAzureCliCredential()
         {
-            var result = new Azure.Identity.AzureCliCredentialOptions { TenantId = TenantId, AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(result);
+            return new(ConfigureOptions(new Azure.Identity.AzureCliCredentialOptions()));
         }
 
         internal Azure.Identity.VisualStudioCredential CreateVisualStudioCredential()
         {
-            var result = new Azure.Identity.VisualStudioCredentialOptions { TenantId = TenantId, AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(result);
+            return new(ConfigureOptions(new Azure.Identity.VisualStudioCredentialOptions()));
         }
 
         internal Azure.Identity.VisualStudioCodeCredential CreateVisualStudioCodeCredential()
         {
-            var result = new Azure.Identity.VisualStudioCodeCredentialOptions { TenantId = TenantId, AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(result);
+            return new(ConfigureOptions(new Azure.Identity.VisualStudioCodeCredentialOptions()));
         }
 
         //internal Azure.Identity.InteractiveBrowserCredential CreateInteractiveBrowserCredential()
@@ -169,40 +168,112 @@ internal Azure.Identity.VisualStudioCodeCredential CreateVisualStudioCodeCredent
 
         internal Azure.Identity.ClientSecretCredential CreateClientSecretCredential(string appId, string appKey, string tenantId)
         {
-            var result = new Azure.Identity.ClientSecretCredentialOptions { AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled, DisableInstanceDiscovery = DisableInstanceDiscovery };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(string.IsNullOrEmpty(tenantId) ? TenantId : tenantId, appId, appKey, result);
+            return new(string.IsNullOrEmpty(tenantId) ? TenantId : tenantId, appId, appKey, ConfigureOptions(new Azure.Identity.ClientSecretCredentialOptions()));
         }
 
-        internal Azure.Identity.ManagedIdentityCredential CreateManagedIdentityCredential(int _1, string appId)
+        internal Azure.Identity.ManagedIdentityCredential CreateManagedIdentityCredential(string appId)
         {
-            return new(appId, this);
+            return new(appId, options: this);
         }
 
-        internal Azure.Identity.ManagedIdentityCredential CreateManagedIdentityCredential(int _1)
+        internal Azure.Identity.ManagedIdentityCredential CreateManagedIdentityCredential()
         {
-            return new(options: this);
+            return CreateManagedIdentityCredential(null!);
         }
 
         internal Azure.Identity.WorkloadIdentityCredential CreateWorkloadIdentityCredential(string appId)
         {
-            Azure.Identity.WorkloadIdentityCredentialOptions result = new() { ClientId = appId, AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled, DisableInstanceDiscovery = DisableInstanceDiscovery, TenantId = TenantId };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(result);
+            return new(ConfigureOptions(new Azure.Identity.WorkloadIdentityCredentialOptions() { ClientId = appId }));
         }
 
         internal Azure.Identity.WorkloadIdentityCredential CreateWorkloadIdentityCredential()
         {
-            Azure.Identity.WorkloadIdentityCredentialOptions result = new() { AuthorityHost = AuthorityHost, IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled, DisableInstanceDiscovery = DisableInstanceDiscovery, TenantId = TenantId };
-            CopyAdditionallyAllowedTenants(result.AdditionallyAllowedTenants);
-            return new(result);
+            return new(ConfigureOptions(new Azure.Identity.WorkloadIdentityCredentialOptions()));
         }
 
-        void CopyAdditionallyAllowedTenants(IList<string> additionalTenants)
+        // Based on https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Credentials/TokenCredentialOptions.cs#L50 method Clone
+        private T ConfigureOptions<T>(T options) where T : Azure.Identity.TokenCredentialOptions
         {
-            foreach (var tenant in AdditionallyAllowedTenants)
+            CopyTenantId(options);
+
+            // copy TokenCredentialOptions Properties
+            options.AuthorityHost = AuthorityHost;
+
+            options.IsUnsafeSupportLoggingEnabled = IsUnsafeSupportLoggingEnabled;
+
+            // copy TokenCredentialDiagnosticsOptions specific options
+            options.Diagnostics.IsAccountIdentifierLoggingEnabled = Diagnostics.IsAccountIdentifierLoggingEnabled;
+
+            // copy ISupportsDisableInstanceDiscovery
+            CopyDisableInstanceDiscovery(options);
+
+            // copy ISupportsTokenCachePersistenceOptions
+            CopyTokenCachePersistenceOptions(options);
+
+            // copy ISupportsAdditionallyAllowedTenants
+            CopyAdditionallyAllowedTenants(options);
+
+            // copy base ClientOptions properties
+
+            // only copy transport if the original has changed from the default so as not to set IsCustomTransportSet unintentionally
+            if (Transport != Default.Transport)
             {
-                additionalTenants.Add(tenant);
+                options.Transport = Transport;
+            }
+
+            // clone base Diagnostic options
+            options.Diagnostics.ApplicationId = Diagnostics.ApplicationId;
+            options.Diagnostics.IsLoggingEnabled = Diagnostics.IsLoggingEnabled;
+            options.Diagnostics.IsTelemetryEnabled = Diagnostics.IsTelemetryEnabled;
+            options.Diagnostics.LoggedContentSizeLimit = Diagnostics.LoggedContentSizeLimit;
+            options.Diagnostics.IsDistributedTracingEnabled = Diagnostics.IsDistributedTracingEnabled;
+            options.Diagnostics.IsLoggingContentEnabled = Diagnostics.IsLoggingContentEnabled;
+
+            CopyListItems(Diagnostics.LoggedHeaderNames, options.Diagnostics.LoggedHeaderNames);
+            CopyListItems(Diagnostics.LoggedQueryParameters, options.Diagnostics.LoggedQueryParameters);
+
+            // clone base RetryOptions
+            options.RetryPolicy = RetryPolicy;
+
+            options.Retry.MaxRetries = Retry.MaxRetries;
+            options.Retry.Delay = Retry.Delay;
+            options.Retry.MaxDelay = Retry.MaxDelay;
+            options.Retry.Mode = Retry.Mode;
+            options.Retry.NetworkTimeout = Retry.NetworkTimeout;
+
+            return options;
+        }
+
+        private static void CopyListItems<TItem>(IList<TItem> source, IList<TItem> destination)
+        {
+            foreach (var item in source)
+            {
+                destination.Add(item);
+            }
+        }
+
+        private void CopyTenantId<T>(T options) where T : Azure.Identity.TokenCredentialOptions
+        {
+            options?.GetType().GetProperty(nameof(TenantId))?.SetValue(options, TenantId);
+        }
+
+        private void CopyDisableInstanceDiscovery<T>(T options) where T : Azure.Identity.TokenCredentialOptions
+        {
+            options?.GetType().GetProperty(nameof(DisableInstanceDiscovery))?.SetValue(options, DisableInstanceDiscovery);
+        }
+
+        private void CopyTokenCachePersistenceOptions<T>(T options) where T : Azure.Identity.TokenCredentialOptions
+        {
+            options?.GetType().GetProperty(nameof(TokenCachePersistenceOptions))?.SetValue(options, TokenCachePersistenceOptions);
+        }
+
+        void CopyAdditionallyAllowedTenants<T>(T options) where T : Azure.Identity.TokenCredentialOptions
+        {
+            var additionalTenants = options?.GetType().GetProperty(nameof(AdditionallyAllowedTenants))?.GetValue(options) as IList<string>;
+
+            if (additionalTenants is not null)
+            {
+                CopyListItems(AdditionallyAllowedTenants, additionalTenants);
             }
         }
     }
@@ -367,30 +438,24 @@ internal static TokenCredential Create(AzureServicesConnectionStringCredentialOp
                     }
                     else
                     {
-                        ValidateMsiRetryTimeout(connectionSettings, options.ConnectionString);
+                        ValidateAndSetMsiRetryTimeout(connectionSettings, options);
 
                         // If certificate or client secret are not specified, use the specified managed identity
-                        azureServiceTokenCredential = options.CreateManagedIdentityCredential(
-                            connectionSettings.TryGetValue(MsiRetryTimeout, out var value)
-                                ? int.Parse(value)
-                                : 0,
-                                appId);
+                        azureServiceTokenCredential = options.CreateManagedIdentityCredential(appId);
                     }
                 }
                 else
                 {
-                    ValidateMsiRetryTimeout(connectionSettings, options.ConnectionString);
+                    ValidateAndSetMsiRetryTimeout(connectionSettings, options);
 
                     // If AppId is not specified, use Managed Service Identity
-                    azureServiceTokenCredential = options.CreateManagedIdentityCredential(
-                        connectionSettings.TryGetValue(MsiRetryTimeout, out var value)
-                            ? int.Parse(value)
-                            : 0);
+                    azureServiceTokenCredential = options.CreateManagedIdentityCredential();
                 }
             }
             else if (string.Equals(runAs, Workload, StringComparison.OrdinalIgnoreCase))
             {
-                // If RunAs=Workload use the specified Workload Identity
+                // RunAs=Workload
+                // Use the specified Workload Identity
                 // If AppId key is present, use it as the ClientId
                 if (connectionSettings.TryGetValue(AppId, out var appId))
                 {
@@ -468,18 +533,21 @@ private static void ValidateAttribute(Dictionary<string, string> connectionSetti
         //    }
         //}
 
-        private static void ValidateMsiRetryTimeout(Dictionary<string, string> connectionSettings, string connectionString)
+        private static void ValidateAndSetMsiRetryTimeout(Dictionary<string, string> connectionSettings, AzureServicesConnectionStringCredentialOptions options)
         {
             if (connectionSettings != null && connectionSettings.TryGetValue(MsiRetryTimeout, out var value))
             {
                 if (!string.IsNullOrWhiteSpace(value))
                 {
                     var timeoutString = value;
 
-                    var parseSucceeded = int.TryParse(timeoutString, out _);
-                    if (!parseSucceeded)
+                    if (int.TryParse(timeoutString, out var timeoutValue) && timeoutValue >= 0)
+                    {
+                        options.Retry.NetworkTimeout = TimeSpan.FromSeconds(timeoutValue);
+                    }
+                    else
                     {
-                        throw new ArgumentException($"Connection string '{connectionString}' is not valid. MsiRetryTimeout '{timeoutString}' is not valid. Valid values are integers greater than or equal to 0.", nameof(connectionString));
+                        throw new ArgumentException($"Connection string '{options.ConnectionString}' is not valid. MsiRetryTimeout '{timeoutString}' is not valid. Valid values are integers greater than or equal to 0.", nameof(options));
                     }
                 }
             }

src/CommonUtilities/CommonUtilities.csproj

@@ -18,6 +18,7 @@
     <PackageReference Include="Microsoft.Extensions.Options" Version="8.0.2" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="Polly" Version="8.4.2" />
+    <PackageReference Include="Polly.Contrib.WaitAndRetry" Version="1.1.1" />
     <PackageReference Include="System.Linq.Async" Version="6.0.1" />
     <!--Mitigate reported security issues-->
     <PackageReference Include="System.Text.Json" Version="8.0.5" />